A ransomware attack usually runs in three stages. First the attacker gets into the network and sets up control. Then the encryption malware activates and locks data across systems. Finally a ransom notice appears with payment terms. The long quiet first stage is where defenders have the most room to act.
Stage one: access
The UK National Cyber Security Centre (NCSC) describes the first stage as attackers getting into a network, setting up control, and installing the encryption malware. They may also copy data at this point and threaten to leak it later.
This stage is not noisy. Nothing is encrypted yet, so users notice nothing. CISA's guide lists the entry points seen most often: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infections, advanced social engineering, and third parties such as managed service providers.
Stage two: activation
The NCSC says the malware then locks devices and encrypts data across the network. From the user's side, files stop opening and systems stop working.
CISA's response checklist hints at what happens between stages one and two. Attackers create new accounts, escalate privileges, and tamper with backups and shadow copies. They also dump credentials and move between machines. Those are the preparation steps for a wide, simultaneous encryption.
Stage three: the demand
A notice explains the payment terms. The NCSC notes the request is usually for cryptocurrency through an anonymous web page. If data was copied earlier, the notice may add a threat to publish it.
By the time you see the note, the decisions that matter most were made weeks or months earlier: whether backups were reachable, whether admin accounts were separated, whether remote access was exposed.
Where defenders can break the chain
- At access: patch internet-facing systems, use phishing-resistant MFA, and do not expose remote desktop services to the web.
- Between access and activation: watch for new privileged accounts, unexpected remote management tools, and attempts to delete shadow copies or backups.
- At activation: isolate affected systems quickly so the encryption does not spread further.
- After the demand: recover from backups you tested before the incident.
If you want a picture of the whole sequence for your own estate, list your internet-facing assets first. Safeguard's asset discovery and dependency scanning can help you see what is exposed and which known vulnerabilities in your software are actually reachable. That is one input, not a full ransomware defence.
Quick check
Does ransomware encrypt files as soon as it gets in?
Not usually. The NCSC describes access and setup as a separate first stage, and encryption as a later activation stage.
Is the ransom note the start of the incident?
No. It is the last visible stage. The intrusion began earlier, which is why logs from before the note matter for the investigation.
Sources
Last reviewed: 19 October 2026.
